• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #64146
• [2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #64739
• [5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #63904
• [5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #64721
• [e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #64721
• [ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #64543
• [df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #64565
• [74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #63963
• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #63949
• [58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #64776
• [478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #64776
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #64746
• [fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #64852
• [c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #64852
• [c68c7d0112] - crypto: validate key generation options (Filip Skokan) #64852
• [c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #64852
• [f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #64851
• [2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #64851
• [4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #64851
• [12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #64692
• [474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #64467
• [718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #64883
• [657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #64944
• [75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #64943
• [07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #64945
• [f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #64942
• [8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #64941
• [5919d01525] - deps: update googletest to 1b6f64d659944658a4c685b7bd9f04c1c3b8a39b (Node.js GitHub Bot) #64940
• [4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #64939
• [c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #64744
• [2b59984c0f] - deps: V8: backport 5177b10891e6 (avivkeller) #64631
• [b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #64790
• [70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #64543
• [308c6b2ac3] - deps: V8: backport 7d9b7e03141d (Manish Goregaokar) #64543
• [8eeae28e88] - deps: V8: backport c4d06ba586f3 (liujiahui) #63731
• [bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #64497
• [ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #64957
• [1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #64952
• [63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #64946
• [b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #64769
• [f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #64896
• [16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #64843
• [335c28cd17] - doc: fix typos in documentation (greenhead) #64900
• [d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #64872
• [e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #64899
• [7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #64874
• [8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #64789
• [a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #64862
• [3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #64516
• [70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #64837
• [d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #64814
• [a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #64806
• [e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #64805
• [e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #64791
• [efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #64584
• [db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #64742
• [a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #59557
• [1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #62010
• [29709324e0] - doc: update technical priorities (Jacob Smith) #64505
• [522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #63175
• [c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #63918
• [428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram Kamat) #64881
• [33912103e7] - ffi: reject fast calls after library close (Trivikram Kamat) #64860
• [b348ed7f92] - ffi: validate fast 32-bit integer argument ranges (Trivikram Kamat) #64691
• [48f4cfb480] - ffi: fix optimized buffer conversions (Trivikram Kamat) #64639
• [109ffcd4f3] - ffi: preserve link register in ppc64 trampoline (Trivikram Kamat) #64792
• [aa3f168b31] - ffi: preserve strings during reentrant calls (Trivikram Kamat) #64551
• [ca60942f38] - ffi: preserve uint8 semantics for bool fast calls (Trivikram Kamat) #64527
• [0fb1d2bd65] - ffi: validate fast integer argument ranges (Trivikram Kamat) #64614
• [b250b40b30] - fs: key glob matcher cache by platform (Archkon) #64571
• [e26891ec6a] - http: fix writableFinished and 'finish' after write errors (Tim Perry) #64847
• [dfc192fdfb] - http: avoid aborting IncomingMessage signal on normal close (Archkon) #64392
• [6794441c85] - http: guard invalid timeout values in checkConnections (Efe Karasakal) #64506
• [6879aa4aa8] - http: propagate highWaterMark to ClientRequest OutgoingMessage (trivenay) #64653
• [72448a82f4] - http2: avoid copying the options in respond() (Matteo Collina) #64265
• [f6692da576] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
• [3ed37153f8] - http2: reduce per-request allocations (Matteo Collina) #64265
• [bce92debba] - Revert "http2: avoid per-write closures in kWriteGeneric" (Antoine du Hamel) #64663
• [b5d5dd74a1] - Revert "http2: avoid copying the options in respond()" (Antoine du Hamel) #64663
• [19b9c14d60] - lib: fix AbortSignal.any() observed-composite leak (Paul Bouchon) #64481
• [d3cada57c2] - lib: fix typo in comment in _http_client.js (agape1225) #64729
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #64565
• [6c2157522d] - loader: enforce path normalization before lookup (Maël Nison) #63917
• [31522c41a7] - meta: bump actions/stale from 10.3.0 to 11.0.0 (dependabot[bot]) #64935
• [88c8b8ef54] - meta: bump github/codeql-action/analyze from 4.36.2 to 4.37.3 (dependabot[bot]) #64934
• [9dcd759a84] - meta: bump github/codeql-action/autobuild from 4.36.2 to 4.37.3 (dependabot[bot]) #64933
• [82ca02db3c] - meta: bump actions/setup-python from 6.3.0 to 7.0.0 (dependabot[bot]) #64932
• [848e2287f2] - meta: bump github/codeql-action/init from 4.36.2 to 4.37.3 (dependabot[bot]) #64931
• [ae8ad3b17b] - meta: bump Mozilla-Actions/sccache-action from 0.0.10 to 0.0.11 (dependabot[bot]) #64930
• [0b359cfa4c] - meta: bump cachix/install-nix-action from 31.10.6 to 31.11.0 (dependabot[bot]) #64929
• [3b4f980f4c] - meta: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 (dependabot[bot]) #64927
• [d7ee9e9ea7] - meta: bump step-security/harden-runner from 2.19.4 to 2.20.0 (dependabot[bot]) #64926
• [7e80bbaaa9] - meta: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (dependabot[bot]) #64925
• [915cabbfcf] - meta: remove node_crates .gitignore (René) #64779
• [8e03c54347] - meta: add @nodejs/url as codeowner for node_url_pattern.* (Efe Karasakal) #64737
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #63928
• [fffd8a76d0] - net: support TCP handle transfer on Windows (Matteo Collina) #64460
• [fe9e0dbdc2] - net: support AF_UNIX paths in net.BoundSocket (Guy Bedford) #64399
• [eb61b7ee1e] - permission: add unique warning codes (David Evans) #64414
• [999a928822] - permission: support v8.setHeapSnapshotNearHeapLimit (Ilyas Shabi) #64808
• [7de3d095b6] - quic: fix stop sending behaviour & callback (Tim Perry) #64710
• [6289398bb2] - quic: fix coverage comment typo (Jungwon Sohn) #64486
• [01510dc759] - quic: fix segfault after fragmented client hello (Tim Perry) #64720
• [dcc348af97] - quic: serialize stream reset code as string (한만욱) #64577
• [c25b8e3331] - readline: reduce createInterface overhead (Matteo Collina) #64585
• [14e802d1cd] - sqlite: invalidate sessions when closing database (Trivikram Kamat) #64783
• [279547b7da] - sqlite: check database state before calling SQLite (Trivikram Kamat) #64812
• [bb86521a42] - sqlite: fix crash when a session outlives its database (Mohamed Sayed) #63797
• [870f4997e7] - sqlite: fix use-after-free in Exec() and ApplyChangeset() (Matteo Collina) #64535
• [a8ec5a9df7] - src: fix perfetto build on GetTraceFilePath (Chengzhong Wu) #64721
• [6cd643acaa] - src: implement MemoryRetainer protocol for ByteSource (Filip Skokan) #64660
• [8725e56928] - src: fix crash when writing odd-length hex string via Writev (RajeshKumar11) #63658
• [e018f9a4a1] - (SEMVER-MINOR) src: add perfetto trace agent (Chengzhong Wu) #64565
• [0611d443ab] - (SEMVER-MINOR) src: rename legacy trace event headers (Chengzhong Wu) #64565
• [2897cc1d93] - (SEMVER-MINOR) src: fix trace macro compatibility (Chengzhong Wu) #64565
• [d4d7172e10] - src: avoid using ToLocalChecked in crypto_hash (James M Snell) #64668
• [53b7d48b47] - src: fix libuv assertion on windows (liuxingbaoyu) #61999
• [69d10ed021] - src,test: disable trace events tests when perfetto is enabled (Chengzhong Wu) #64721
• [1b0597b4ef] - stream: cut per-chunk allocations in pipeTo (Matteo Collina) #64890
• [2632d606bb] - stream: preserve push signal abort reason (Trivikram Kamat) #64798
• [d5358a75bc] - stream: skip zero-byte broadcast writes (Trivikram Kamat) #64772
• [796c896fb4] - stream: honor AbortSignal in Writer.end() (Trivikram Kamat) #64727
• [ff12b8e22e] - stream: use validateString for consumer encoding (Jungwon Sohn) #64754
• [cfad2efb06] - stream: use the ring buffer for pending BYOB pull-into descriptors (Matteo Collina) #64818
• [fe06bf56dc] - stream: fix uncatchable error closing half-open Duplex.toWeb() writable (Mohamed Sayed) #64161
• [f2919dbb83] - test: unflake debugger and REPL tests (Matteo Collina) #64718
• [a1c29174e8] - test: ensure assertions are reached on all tests (Antoine du Hamel) #64716
• [b9e596f8e5] - test: reuse ffi.suffix instead of reimplementing it (Seongeun Lee) #64840
• [c816918e14] - test: remove test-repl-user-error-handler from flaky (avivkeller) #64631
• [9d2f10ec54] - test: update WPT for url to 4832db4761 (Node.js GitHub Bot) #64829
• [75b80d0b7b] - test: update WPT for url to b63305b743 (Node.js GitHub Bot) #64790
• [9a139b3c86] - test: cover worker throwing primitive values (varshitha) #64365
• [796acc8920] - test: mark test-repl-user-error-handler as flaky (Aviv Keller) #64612
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #64830
• [4368303e01] - test_runner: wait for filtered suite build (semimikoh) #64208
• [70d11241a3] - test_runner: convert to uint during deserialization (Aviv Keller) #64706
• [cafe7bffcc] - tls: fix SNICallback certificate selection (Matteo Collina) #64700
• [9ee05ec40f] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #64928
• [5f4b859932] - tools: bump brace-expansion from 5.0.7 to 5.0.9 in /tools/eslint (dependabot[bot]) #64904
• [b5ced907b3] - tools: use 'readonly' for EventSource global (Honey Tyagi) #64787
• [fd4460e34e] - typings: add heap_utils internalBinding types (Donghoon Kang) #64816
• [3bc0ee0492] - typings: remove isDataView from types binding (Archkon) #64738
• [236d7ca965] - url: create URLPattern result properties in WebIDL order (Archkon) #64733
• [3def577ab4] - v8: report minor mark-sweep in GCProfiler (Archkon) #64688
• [5293abff73] - vfs: speed up recursive readdir test setup (Trivikram Kamat) #64813
• [4345185496] - vfs: make lchown update symlink metadata (Trivikram Kamat) #64573
• [b6ab546de5] - wasm: register missing SetURL function (Archkon) #64679
• [f322870bd1] - zlib: validate pledgedSrcSize as a safe integer (Archkon) #64604
• [44042c20d4] - zlib: accept ArrayBuffer dictionary in Zstd (Ryuhei Shima) #64599

• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309

• [248ff9fa5c] - assert,util: fix TypeError on Maps with null keys (Paul Bouchon) #64441
• [3b5baceafe] - benchmark: add bytes variant to webstreams async-iterator (Matteo Collina) #64291
• [0a46d1ef66] - buffer: normalize lone "\r" in Blob native line endings (Daijiro Wachi) #64115
• [d9ada18b70] - buffer: fix Blob.stream() leaking source buffer (semimikoh) #63577
• [d05993bcf6] - build: merge multiple on download artifact (Chengzhong Wu) #64633
• [6c25ac909a] - build: extract temporal_capi crate directory name into gyp variable (René) #64482
• [612f60c300] - cli: style node --help output with util.styleText (Adrián Estrada) #64484
• [29a938ddbb] - crypto: preserve RSA-PSS legacy pubkey DER (Filip Skokan) #64547
• [2fde794357] - crypto: cleanse provider private key copies (Filip Skokan) #64547
• [33a0e08d41] - crypto: handle incomplete RSA private keys (Filip Skokan) #64547
• [11b4d505ef] - crypto: retain legacy DH validation (Filip Skokan) #64547
• [6e302041e1] - crypto: limit KangarooTwelveParams customization to 512 bytes (Filip Skokan) #64557
• [195f103e87] - crypto: split OpenSSL 3, BoringSSL, and legacy backends (Filip Skokan) #64211
• [ec67e24eee] - deps: update googletest to fa005b296f90faec4f352d7ab382287bf6548c8d (Node.js GitHub Bot) #64587
• [32ffff88fd] - deps: histogram: cherry-pick 62ea52b07ee9b195 (StefanStojanovic) #64296
• [e0664f1f09] - deps: update histogram to 0.11.10 (Node.js GitHub Bot) #64296
• [cf0622bdd6] - deps: update amaro to 1.1.11 (Node.js GitHub Bot) #64586
• [04c78b8b24] - deps: update timezone to 2026c (Node.js GitHub Bot) #64588
• [59f4318976] - deps: V8: cherry-pick 1158ae719749 (René) #64432
• [e5ea7cd299] - deps: update googletest to 8240fa7d62f73e01c7af27d61ed965d6d66698fa (Node.js GitHub Bot) #64439
• [0e7554cee4] - deps: update libffi to 3.7.1 (Node.js GitHub Bot) #64438
• [46c9d724ad] - deps: update ngtcp2 to 1.24.0 (Node.js GitHub Bot) #64297
• [3519aac9af] - deps: enable OpenSSL asm support for riscv64 (Jamie Magee) #62606
• [c09701218b] - deps: update c-ares to 1.34.8 (Node.js GitHub Bot) #64330
• [ad2f3bc95b] - deps: upgrade npm to 11.18.0 (npm team) #64199
• [d7a4b22c86] - deps: V8: backport a05321ebd98e (Chengzhong Wu) #64202
• [8679cff291] - deps: update zlib to 1.3.2.1-motley-8b3aa8a (Node.js GitHub Bot) #64295
• [df5b1e10ba] - doc: remove unsupported syntax from stream_iter.md (Antoine du Hamel) #64649
• [8a4ca9083f] - doc: clarify rules for adding new built-in modules (Antoine du Hamel) #64648
• [7d50fe6b7a] - doc: mention DEPENDENCY custom field for H1 reports (Rafael Gonzaga) #64634
• [8f415bf5fc] - doc: fix dnsPromises.lookup verbatim default (Shivam S) #64658
• [c6378f724d] - doc: fix broken links and clean up type map (Antoine du Hamel) #64625
• [9b53ec19a2] - doc: fix typo in releases guide (Jihwan) #64621
• [5a36018abc] - doc: add MikeMcC399 as collaborator (Mike McCready) #64656
• [d2c8acd764] - doc: use promote wording in release guide (Md Muhtasim Munif Fahim) #64371
• [5c692cb576] - doc: fix import.meta example for vm.SourceTextModule (Muhammad Zeeshan) #64112
• [7568ce71ca] - doc: mention crypto.hash() for better perf (Steven) #63420
• [cf3f631936] - doc: update sea example by fixing wrong code example (Maxence Robinet) #64025
• [ce21e567a4] - doc: fix socket.readyState state descriptions (YuSheng Chen) #64468
• [018c7f1c01] - doc: replace large tables in crypto.md and webcrypto.md with lists (Filip Skokan) #64582
• [cf82de8d8b] - doc: note --env-file is not applied to --run (Paul Bouchon) #64442
• [e635ce5201] - doc: fix typo in embedding.md (greenhead) #64425
• [0b1f6eda3f] - doc: fix typos in contributing docs (Donghoon Kang) #64520
• [d978ce80ef] - doc: document TLS alpnProtocol and servername fields (Tim Perry) #64362
• [394669e3b3] - doc: fix spelling in devcontainer guide (한만욱) #64459
• [9786a593ea] - doc: clarify PEM format for signing keys (Harjoth Khara) #64404
• [6251f832ba] - doc: fix typo in tls.md (Daijiro Wachi) #64458
• [b8656c40ad] - doc: document net Socket server property (Efe Karasakal) #64364
• [03e9c738f3] - doc: update a Dispatcher undici doc link (Filip Skokan) #64358
• [b6dd2debf0] - doc: fix typos in documentation (Jungwon Sohn) #64466
• [3b7d778c3c] - doc: clarify fixes and refs trailer guidance (Trivikram Kamat) #64421
• [eb086a6e03] - doc: remove duplicate VirtualProvider description (Archkon) #64400
• [bc221a8cd7] - doc: add scope overview tables for TestsStream events (Moshe Atlow) #64386
• [4b3dbd36df] - doc: clarify proxy threat model (Matteo Collina) #64366
• [c5526f69d6] - doc: add note about restricted CI to pull-requests.md (Stewart X Addison) #64321
• [968eaf6538] - doc: various updates to releases.md (Stewart X Addison) #64198
• [2a51f8ba8e] - doc: remove obsolete --napi-modules doc entry (Chengzhong Wu) #64220
• [ee5a54535e] - doc,test: widen fsPromises.appendFile()'s data type, add missing tests (Jimmy Leung) #64279
• [b923df86fc] - events: avoid retaining removed event names (Matteo Collina) #64475
• [7d8d413ff5] - events: optimize once() and removeListener() (Matteo Collina) #64373
• [f2f8881d2a] - ffi: evaluate function signatures once (Trivikram Kamat) #64559
• [9b04f82d7b] - (SEMVER-MINOR) ffi: add getCurrentEventLoop (Paolo Insogna) #64323
• [4a3ef5b2b5] - fs: add pattern cache for matchGlobPattern() (bq) #63915
• [ce113efcac] - fs: fix cp symlink and EEXIST handling on Windows (Kirill Saied) #64353
• [3be3041ac9] - http: fix perf_hooks detail.req.url port and proxied path (Stefano Baghino) #64311
• [0047ad73cf] - http: remove unused n arg from IncomingMessage._read (Efe Karasakal) #64370
• [4d48984d5c] - http2: don't throw when destroying socket proxy (Matteo Collina) #64427
• [3329647762] - http2: avoid copying the options in respond() (Matteo Collina) #64265
• [a44fca5e24] - http2: avoid per-write closures in kWriteGeneric (Matteo Collina) #64265
• [546e0e70a1] - inspector: add --cond to node inspect probe mode (Joyee Cheung) #64328
• [b38a39dd96] - lib: use assignFunctionName util where it makes sense (Antoine du Hamel) #64515
• [f60a12b94f] - lib,tools: add node-core/func-name-matching lint rule (Livia Medeiros) #57901
• [9e6e9d4745] - meta: lower stale to 3 months (Aviv Keller) #64569
• [3dd11c4993] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64315
• [3f55208104] - module: add two tests for eager imports when using import defer (Maya Lekova) #64197
• [c791eedc9d] - net: support sync connect for BoundSocket (Guy Bedford) #64375
• [4df4a3fc61] - net: make TCP Server and Socket transferable across worker threads (Matteo Collina) #64225
• [5dd34d7d06] - path: add benchmarks for path.matchesGlob() (bq) #63915
• [8e520646b6] - quic: defer server session emit until TLS ClientHello is processed (Tim Perry) #64132
• [4b8cc9a3fb] - quic: preserve session stats after close (한만욱) #64489
• [591090ca85] - quic: add support for TLS certificate compression (Sebastian Beltran) #64434
• [d636c9c30f] - quic: extract transport logic from Application to Session (Tim Perry) #64127
• [abb62f961f] - quic: correct http3 callback and fix revealed errs (Marten Richter) #64289
• [5f535fdbe8] - quic: fix no onstream handler crash quic (Efe) #64158
• [933e5f14b5] - quic: fix stall datagrams, if no pending streams (Marten Richter) #64303
• [272632a57f] - quic: fix potential crash from unobserved closed (Tim Perry) #64134
• [2d5f445489] - sqlite: read column count after step in StatementSync.all() (Guilherme Araújo) #64219
• [54929af44e] - src: avoid redundant KEM encapsulation copies (Filip Skokan) #64553
• [5380bf28b3] - src: avoid redundant DataPointer reallocations (Filip Skokan) #64552
• [6ff5a1b834] - src: fix comment typos (Jungwon Sohn) #64509
• [508ec0e435] - src: zero-initialize cap_data in node_credentials.cc (Samuel Kapust) #64347
• [c5090a36c1] - src: fix some typo errors and rename some variables (Archkon) #64301
• [0a89bef69e] - src,permission: do not throw on denied access in audit mode (Adrián Estrada) #64426
• [63e71195c5] - stream: abort pending single-source merge reads (Trivikram Kamat) #64445
• [f403b30c3d] - stream: use RangeError for broadcast overflow (Trivikram Kamat) #64420
• [5c0578cbf7] - stream: skip null output from stateful transforms (Trivikram Kamat) #64462
• [0488d02d5d] - stream: update iterable streams to use budget backpressure (James M Snell) #64464
• [f0811baeef] - stream: remove custom CloneableDOMException implementation (Antoine du Hamel) #64469
• [10f3f9682e] - stream: fix drop-newest behavior in share() (Trivikram Kamat) #64417
• [2aad973b29] - stream: resume flow when an errored pipe destination is removed (Mahin Anowar) #64310
• [6112ed5ceb] - stream: fold desired-size check into WHATWG backpressure update (Matteo Collina) #64451
• [d829aa1138] - stream: validate writer options signal (Trivikram Kamat) #64385
• [8e7a5e940e] - stream: reject push iterator.throw() with error (Trivikram Kamat) #64380
• [4390f81294] - stream: simplify nested PromisePrototypeThens (Antoine du Hamel) #64470
• [ddf2c38e9d] - stream: use the ring buffer for WHATWG stream request queues (Matteo Collina) #64431
• [518d81b36d] - stream: validate writevSync chunks before queuing (Trivikram Kamat) #64300
• [f745c4261d] - stream: speed up reads and iteration over default WHATWG streams (Matteo Collina) #64320
• [4f4bce62fe] - stream: copy SAB-backed chunks in iter consumers (Trivikram Kamat) #64382
• [f29937d26f] - stream: reject nested async streamables in from() (Trivikram Kamat) #64352
• [424cec71b7] - stream: avoid draining merged iter sources (Trivikram Kamat) #64293
• [e01906180c] - stream: use ring buffer for WHATWG stream queues (Yagiz Nizipli) #64312
• [0a0193f666] - stream: hoist repeated loads in readable paths (Yagiz Nizipli) #64312
• [ebe16003b6] - stream: prefer sync iterator in fromSync (Trivikram Kamat) #64294
• [f249614835] - stream: speed up async iteration over WHATWG byte streams (Matteo Collina) #64291
• [7331118699] - stream, quic: update iterable streams backpressure (James M Snell) #64464
• [46b117729d] - test: update quic tests for stream/iter update (James M Snell) #64464
• [b122ca5389] - test: fix flaky http2 socket proxy test (Tim Perry) #64673
• [68c46146fd] - test: apply correction to comment (Rich Trott) #64524
• [d7e119b26b] - test: keep finalization before-exit ref alive (Tim Perry) #64521
• [0db4e10a0c] - test: copyedit test-tls-psk-alpn-callback-exception-handling (Antoine du Hamel) #63485
• [21389f7b25] - test: fix stale async-context-frame status entries (Kirill Saied) #64141
• [af55304846] - test: update WPT for urlpattern to 5847ee5cfa (Node.js GitHub Bot) #64436
• [43a5ce4e00] - test: update WPT for WebCryptoAPI to ec2fee39a4 (Node.js GitHub Bot) #64435
• [11ca52a521] - test: fix flaky http2 maxOriginSetSize test (Tim Perry) #64407
• [af08a11e77] - test: fix 2nd flaky blob test case (Tim Perry) #64391
• [0104ae1171] - test: fix flaky watch + cwd + argv test-runner test (Tim Perry) #64372
• [b3ff5fe3f4] - test: normalize Windows crash in debugger test normalization (Joyee Cheung) #64332
• [4cdceb7436] - test: unmark flaky http2-large-file for Win (Kirill Saied) #64255
• [19f529377b] - test: unmark flaky SEA snapshot tests on Windows (Kirill Saied) #64317
• [66f9b342ef] - test: increase timeout in consumed-timeout test (Trivikram Kamat) #64204
• [fdbbf0ae6d] - test: handle null stdio streams in spawnSyncAndAssert helper (Joyee Cheung) #64273
• [10ea17dafe] - test: remove impact of tier-up changes in worker stack size test (Joyee Cheung) #64271
• [bb51f2c960] - (SEMVER-MINOR) test_runner: add context.log() and test:log event (Moshe Atlow) #64389
• [56ce83b3ee] - (SEMVER-MINOR) test_runner: report entryFile in TestStream events (Moshe Atlow) #64309
• [7a02e4f9e6] - timers: do not retain a reference to the async store after firing (Matteo Collina) #53443
• [7d5d46ef00] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
• [f7bc0c62df] - tools: bump brace-expansion from 5.0.6 to 5.0.7 in /tools/eslint (dependabot[bot]) #64636
• [3f80ed2e93] - tools: reference 'git node land' in PR-URL: error message in merge.sh (Stewart X Addison) #64495
• [7b373cafce] - tools: disable zipping tarballs on GHA (Antoine du Hamel) #64423
• [5bdbd256e9] - tools: add workflow to compare Nix changes (Antoine du Hamel) #64410
• [ca4a16634b] - tools: add option for benchmark.yml to post comment on PR (Antoine du Hamel) #64395
• [86193ef193] - tools: fix redundant conditions in v8.gyp for riscv64 and loong64 (Jamie Magee) #62608
• [ee460404be] - util: make MIMEParams accessors case-insensitive (Daijiro Wachi) #64123
• [a63ee46ddd] - vfs: make recursive readdir iterative (AkshatOP) #64149
• [37f93c3b15] - vfs: make lchmod update symlink mode (Trivikram Kamat) #64350
• [ce54e2a9c8] - vfs: fix VirtualReadStream race with async iteration (Y1D7NG) #64394
• [54e8d3a14b] - vfs: follow symlinked dirs in recursive mkdir (Trivikram Kamat) #64287
• [7be42b64e1] - vm: enable interception on global restricted properties (Chengzhong Wu) #64202
• [c2cfcf8e7d] - zlib: reject truncated zstd input (Archkon) #64593

• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217

• [676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [6e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [87e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [32174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [69cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [37ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [2424207191] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [63502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413
• [fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [7907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [0f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [73aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134
• [934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104
• [e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [12c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [9a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [8bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756
• [329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [97b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [9098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [59cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #63437
• [2922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #63286
• [6fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [1ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
• [92a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #63524
• [8b37af8b11] - deps: V8: backport bef0d9c1bc90 (Joyee Cheung) #62132
• [8832126422] - deps: V8: cherry-pick 64b36b441179 (Dan Carney) #61712
• [75990c2cd6] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
• [8500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [dc78091b45] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [873cc72125] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
• [1d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
• [35222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #63857
• [85c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
• [d2ea8b7a8c] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
• [25b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
• [b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
• [0b3b56ee95] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
• [aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
• [ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
• [6edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
• [d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
• [91c9ce5a45] - doc: improve fs.StatFs properties descriptions (aymanxdev) #62578
• [54e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199
• [64c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080
• [bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
• [a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
• [c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
• [d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
• [bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184
• [fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
• [faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
• [79d685adf3] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
• [744e40e05e] - doc: update list of people in SECURITY.md (Richard Lau) #64152
• [185f57c4a4] - doc: add missing option to man page (Richard Lau) #64156
• [8933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
• [3a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
• [5a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [66e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
• [a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961
• [d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939
• [b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
• [f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883
• [df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881
• [a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882
• [206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
• [e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672
• [e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
• [0b3fbc82d7] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
• [62078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
• [fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
• [42cd7e47de] - doc: add worker_threads history entries (Bob Put) #63545
• [d6ab039f24] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [56bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #63493
• [1da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #62562
• [7bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
• [1a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #63518
• [3c1636dabf] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [e0f211ca79] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
• [a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
• [e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
• [c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
• [d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
• [6f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #63117
• [592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
• [c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #61597
• [85a223bf15] - http: fix drain event with cork/uncork (David Evans) #64038
• [8b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
• [e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
• [d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
• [af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
• [cd1ea26110] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
• [5b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
• [823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
• [7f4af5568f] - lib: add Iterator global to primordials (Renegade334) #63698
• [c8f3f5e5a5] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
• [1ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #62756
• [88590d1bb7] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
• [0ea9cb9630] - meta: bump actions/upload-artifact from 7.0.0 to 7.0.1 (dependabot[bot]) #62850
• [f7275a0864] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
• [3a77d21d8c] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
• [84e2836c95] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
• [09f800eec6] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
• [6df1f97e64] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
• [737eb89651] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
• [dac3cd8b8f] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
• [108a6bc481] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
• [34d09a725d] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
• [944d9bc25f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
• [cc22555402] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
• [da7a21931e] - meta: speed up stale bot (Aviv Keller) #64075
• [7bfcf7ca56] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
• [db6c983cdd] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
• [9e4f1339d1] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
• [92c98d3ade] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
• [bbd3ffde89] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
• [a6dd675c82] - module: enable import support for addons by default (Chengzhong Wu) #64221
• [fb2ccb15a1] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
• [b9e17dc424] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
• [a534b65815] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [c55dd030e6] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
• [a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [f08b83bc1d] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
• [8d58e1b415] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
• [c757e3ef59] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
• [87064a096b] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
• [7428b57a37] - (SEMVER-MINOR) src: allow empty --experimental-config-file (Marco Ippolito) #61610
• [d7946c9c07] - src: add test flag to config file (Marco Ippolito) #60798
• [a642657d71] - src: rename config file testRunner to test (Marco Ippolito) #60798
• [818b43d09e] - src: do not enable wasm trap handler if there's not enough vmem (Joyee Cheung) #62132
• [af5e1a9729] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
• [8a5d3bc168] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
• [ce6f29e45b] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
• [96478050f2] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
• [0147ed746e] - src: guard OpenSSL compression header include (Filip Skokan) #64009
• [8d2858a9c4] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
• [e5289d180f] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
• [e8352ff754] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
• [a408f279c5] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
• [4b5eb7b72d] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
• [44976c6071] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
• [5b3bb284f3] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
• [7cdad636c4] - src: fix crash when reading length on Storage.prototype (Mohamed Sayed) #63529
• [c438250c68] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
• [291c127947] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
• [3d91aeb434] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
• [fcbff00a44] - stream: preserve half-open duplexes in async iteration (Efe) #64275
• [e57597173c] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [a48edf40e8] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
• [f58c5bafcf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
• [7261276f45] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
• [1558986b78] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
• [edef89ba6a] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
• [915e3e2f42] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
• [2d29628b5b] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
• [89e23b70c4] - test: deflake test-debugger-probe-timeout (Joyee Cheung) #63547
• [54ca514414] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
• [01cbe530eb] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
• [6fcd3cf516] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
• [f50a55d7e5] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
• [3085714530] - test: fix typo from overriden to overridden (parkhojeong) #63403
• [9f5347e8df] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #64054
• [44b4fe4246] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #64052
• [2f567edaca] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051
• [a56fbb2d36] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
• [b636f4769c] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
• [ba23eb9717] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
• [bc420f20d8] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
• [d2c9c07af8] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
• [4e00c8ec2e] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
• [a17cf06d12] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
• [d59d7fdd16] - test: add coverage outside SEA (Daijiro Wachi) #63744
• [71a32d31bf] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
• [28c77ab174] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
• [9a81921d4a] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
• [88ab61f2f8] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
• [b4f5c86463] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
• [812a66f0ac] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
• [2bf0de838d] - test: cover webcrypto prototype pollution systematically (Filip Skokan) #63520
• [bec6856ae8] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
• [a2b9095e03] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
• [02fbff446f] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
• [094869354a] - test_runner: ignore erased TS lines in coverage (Matteo Collina) #63510
• [68edc2b009] - test_runner: fix suite diagnostic chanel end (Moshe Atlow) #63533
• [659d5bf068] - test_runner: add parentId to test events with testId (Moshe Atlow) #63435
• [eaebeb8b88] - test_runner: fix hooks test context (Moshe Atlow) #63285
• [d03d96889b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #63221
• [e8c3db1364] - test_runner: add getTestContext() (Moshe Atlow) #62501
• [345c591d10] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056
• [2f47fb23bf] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050
• [260cf1ac89] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029
• [24140eafdf] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
• [b7fdb4891a] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
• [e48b307e09] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254
• [5396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [a653e9bb57] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093
• [5e901b5cd9] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [3abcfa723c] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
• [eaba4cd59d] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249
• [7d7ea1dbca] - tools: update c-ares updater script (Antoine du Hamel) #64194
• [976827cd71] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
• [cc0c586b52] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
• [f0a35fa56a] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
• [dafbd23240] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
• [0ae1552650] - tools: update the llhttp updater script (Antoine du Hamel) #63819
• [3623586d1f] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
• [64b130ce1d] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
• [4900cac251] - tools: fix zlib updater script (Antoine du Hamel) #63707
• [8edf3abafc] - typings: add typing for crypto (Filip Skokan) #64122
• [d5be94e820] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
• [ee66a3851c] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022
• [e26f183699] - util: fix scientific notation formatting (Daijiro Wachi) #63823
• [7993e3e476] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
• [38758a7789] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
• [46a0ca256a] - watch: print name of changed file that triggers restart (Marco) #63781
• [e1582818ad] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
• [9a208668b0] - zlib: validate flush king for all streams (Ic3b3rg) #63746
• [928981d803] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746
• [fd0fb00164] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023
• [e334d30b4c] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023
• [7433c3df2e] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556

This is a security release.

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 7.29.0 (Node.js GitHub Bot)

• [6cb0475751] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [bcfe21d3dc] - deps: update undici to 7.29.0 (Node.js GitHub Bot) #64713
• [9d0d36cffd] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [8a008fb523] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [a77c7f7354] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [34ed88a069] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
• [95ba2cfde7] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [fcbdbe47ea] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ea26c12b56] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [9a6b7e343a] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [6c0c990880] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [af9ff0490c] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [05f541b5c0] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.

• (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) – High
• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 6.28.0 (Node.js GitHub Bot)

• [4b12ac38a1] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [3fd0aa51d0] - deps: update undici to 6.28.0 (Node.js GitHub Bot) #64714
• [22efc051a3] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [c8525ac3a6] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#932
• [daa6d25e3d] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [f14d78b9e0] - (CVE-2026-56846) http2: retain header memory in session accounting (Matteo Collina) #63752
• [51123159fe] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#934
• [acaf4266b2] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [440329f624] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [ed18b9cc07] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#926
• [0566c3cccd] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#927
• [0d072480c3] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

This is a security release.

• (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
• (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
• (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
• (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
• (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
• (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
• (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
• (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
• (CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
• (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
• deps: update llhttp to 9.4.3 (Paolo Insogna)
• deps: update undici to 8.9.0 (Node.js GitHub Bot)

• [af0bf96877] - deps: update llhttp to 9.4.3 (Paolo Insogna) nodejs-private/node-private#935
• [0354678355] - deps: update undici to 8.9.0 (Node.js GitHub Bot) #64712
• [dbeeaeec13] - (CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) nodejs-private/node-private#929
• [064d339f56] - (CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) nodejs-private/node-private#922
• [23b94c843a] - (CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) nodejs-private/node-private#921
• [c7ec3dc0b9] - (CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) nodejs-private/node-private#904
• [8f666925b1] - (CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) nodejs-private/node-private#930
• [ad99d075b1] - (CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) nodejs-private/node-private#911
• [61222008b7] - (CVE-2026-58039) permission: check final report output path (RafaelGSS) nodejs-private/node-private#908
• [3cb607dfc4] - (CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) nodejs-private/node-private#924
• [d08fde8a16] - (CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) nodejs-private/node-private#896
• [b3fbb6e11f] - (CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) nodejs-private/node-private#931

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

• [87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #64157
• [06c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605
• [518309c363] - build: suppress clang errors building libffi on Windows (René) #64222
• [6a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
• [66f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [7f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [32bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [0908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [7f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282
• [af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
• [2e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
• [74e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101
• [a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101
• [feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #64101
• [8ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
• [9e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
• [dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407
• [a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #63660
• [8d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
• [da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
• [20ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
• [05eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
• [3966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #64184
• [12a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
• [0854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
• [ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960
• [bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
• [ff537ba858] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
• [f3db304588] - doc: update list of people in SECURITY.md (Richard Lau) #64152
• [2a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #64143
• [85fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130
• [189e830eb3] - doc: add missing option to man page (Richard Lau) #64156
• [7a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931
• [d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #64068
• [60abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
• [e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
• [851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260
• [0cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114
• [aeb539a383] - http: fix drain event with cork/uncork (David Evans) #64038
• [8e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
• [eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
• [243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
• [34a537c0ed] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
• [1f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
• [92a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #64007
• [87b8f2a296] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
• [829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
• [0808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
• [64aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
• [873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245
• [fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
• [845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
• [2cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
• [0ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241
• [c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
• [f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
• [6b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
• [fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
• [7b01040008] - meta: speed up stale bot (Aviv Keller) #64075
• [874c46c24f] - meta: update sccache version in test-linux-quic (René) #64043
• [48c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #64221
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [f90f1bd032] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
• [bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
• [9a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228
• [2699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #64170
• [00dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879
• [ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
• [dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
• [12edf1d68d] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
• [eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897
• [efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066
• [d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013
• [38b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253
• [c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
• [f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082
• [1182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
• [d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015
• [f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997
• [b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
• [d0d8f0c774] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
• [ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
• [570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
• [1b4f213380] - test: fix typo from overriden to overridden (parkhojeong) #63403
• [4c91090b8b] - test: fix typo from funciton to function (parkhojeong) #63403
• [bf080c7917] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #64054
• [24e32098c5] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #64052
• [3229886de2] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051
• [83b91ea6ec] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056
• [269b609a3d] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050
• [0342744c34] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029
• [086741d121] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [3bdd7e20be] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093
• [c96c838977] - tools: update RUSTC_VERSION for remaining GHA workflows (René) #64325
• [ee873b7aaf] - tools: bump temporal_rs version (Antoine du Hamel) #63281
• [ea3b870155] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
• [d940f02e8b] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249
• [fe0ea2bb5d] - tools: bump @node-core/doc-kit (dependabot[bot]) #64010
• [4dceefde1e] - tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot[bot]) #64031
• [6e187db7d7] - tools: update c-ares updater script (Antoine du Hamel) #64194
• [657a35f5a2] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
• [17228a861c] - tools: add GHA benchmark runner (Antoine du Hamel) #60293
• [6d11a71d91] - tools: update build-shared/action.yml to a reusable workflow (Antoine du Hamel) #64059
• [7a17c50b7f] - tools: update libffi updater script (Antoine du Hamel) #64046
• [28047a3e71] - tools: exclude libffi changes from test-shared GHA CI (Antoine du Hamel) #64047
• [58d9685acc] - typings: add typing for crypto (Filip Skokan) #64122
• [7a9dcad44d] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022
• [d5f01bbbde] - vfs: reject rename into descendant directory (Trivikram Kamat) #64285
• [0b6af91081] - vfs: handle current-position sentinel in memory files (Trivikram Kamat) #64163
• [322230d641] - vfs: support writeFileSync with virtual fds (Trivikram Kamat) #64165
• [9395d209c7] - vfs: avoid recursive readdir symlink cycles (Matteo Collina) #64168
• [bbdd7643b6] - vfs: read RealFSProvider files from open fd (Trivikram Kamat) #64104
• [92859b8097] - vm: fix copying PropertyDescriptor (Chengzhong Wu) #64073
• [9046035475] - zlib: validate flush king for all streams (Ic3b3rg) #63746
• [98be4304a3] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746
• [90007a59a9] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023
• [5933516066] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023

• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

• [c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
• [509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
• [86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
• [d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
• [1124c0652d] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
• [a2324246b4] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [2a467a5f69] - Revert "build, doc: generate node.1 with doc-kit" (Antoine du Hamel) #64091
• [e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
• [2ab9848fe4] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [04c04c8b5c] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [f9fdce3f46] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [656e57ebbf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [57ae87640a] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [88011a3689] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
• [4438cb5284] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
• [9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
• [373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
• [e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
• [b1b597c797] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
• [0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
• [e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
• [e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
• [d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
• [bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
• [971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
• [e17f665444] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
• [7591949457] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
• [d75222d7cb] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
• [0cf8342ae2] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
• [e068299320] - doc: update gcc toolchains to gcc-13 and g++-13 (Louie Llaneta) #64018
• [65178bdcf3] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
• [83eedfe85b] - doc: fix typo in util.md (Daijiro Wachi) #63961
• [54948c78e7] - doc: clarify callback exceptions (Matteo Collina) #63939
• [205d0a57f2] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
• [44809b176c] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
• [9cb15fcc85] - doc: fix typo in cli.md (Daijiro Wachi) #63883
• [394d0bb928] - doc: fix typo in vm.md (Daijiro Wachi) #63881
• [59b7be8193] - doc: fix typo in packages.md (Daijiro Wachi) #63882
• [33c236cea9] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
• [30595da67b] - doc: update npm supported versions link (hojeong park) #63672
• [5919ba7e97] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
• [51cab5cb72] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
• [ce85b2af88] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
• [298735e8df] - doc: mark Node.js 25 as End-of-Life (Antoine du Hamel) #63692
• [56948518b9] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
• [32ff731248] - doc: add worker_threads history entries (Bob Put) #63545
• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [d29483fc4f] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
• [6e668331d9] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
• [97aafe2519] - ffi: add fast support for almost all other platforms (Paolo Insogna) #63941
• [f52cf5eeaa] - ffi: add experimental fast FFI call API for AArch64 and x86_64 (Paolo Insogna) #63068
• [d9461fee05] - ffi: port semi-colon fix for riscv64 (and others) (Stewart X Addison) #63794
• [4c8402e0a8] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [3d0097d489] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
• [14d829cb3c] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
• [ceba08a1ea] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
• [6577d3b282] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [b7fd13a59a] - http2: retain header memory in session accounting (Matteo Collina) #63752
• [e611ccd167] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
• [a44f51eef3] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
• [27cc4ec598] - lib: add lint rule to enforce use of kEmptyObject (Antoine du Hamel) #63790
• [7ee31b0bf4] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
• [078457839a] - lib: add Iterator global to primordials (Renegade334) #63698
• [58837dc4dd] - lib: remove source map deadcode in type stripping (Chengzhong Wu) #63738
• [e7513a8b9e] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [ea0b8e1dc2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
• [ac90719532] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
• [3ed3de3062] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
• [d08d57bf70] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
• [e748d192cf] - meta: bump cachix/cachix-action (dependabot[bot]) #63729
• [10554eb131] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
• [791885f2af] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
• [32d9a407d9] - meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6 (dependabot[bot]) #63723
• [b97c7bed07] - module: enable existing machinery for deferred import of static modules (Maya Lekova) #63712
• [4becad2117] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
• [c71c85b95f] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [3988efa1f3] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
• [484efd1c44] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #63946
• [04a17fe6f0] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191
• [b62d5696dc] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #63950
• [3f1c8d7453] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874
• [d8538b9deb] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #63558
• [643b19716e] - quic: add listEndpoints API (James M Snell) #63536
• [2bce35bea4] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
• [394af52abb] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
• [10f03e5958] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
• [1723773d41] - src: keep global list of addon-provided cleanup hooks (Anna Henningsen) #63985
• [ef12e9ea44] - src: guard OpenSSL compression header include (Filip Skokan) #64009
• [48af8a6d8d] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
• [2a672ee9e8] - src: fast path empty native immediate drain (Gürgün Dayıoğlu) #62969
• [db6a31d1a1] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
• [5fb837ff46] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
• [6d22d373a9] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
• [7ac3fe1992] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
• [d82d369155] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
• [03858d152b] - src: remove redundant handle_ field in ffi (Anna Henningsen) #63665
• [1682264f6b] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
• [cc29696acf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
• [d9967a25b2] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #63569
• [b53f8f75c9] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
• [315ca426d8] - stream: handle setEncoding after buffered data (Matteo Collina) #63973
• [06413cd6bd] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
• [a9f9a3dafa] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500
• [009cca11bd] - stream: refine the stream/iter backpressure (James M Snell) #63697
• [3f81dcfc99] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
• [9a83b5d1fe] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
• [0bdf5adea9] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #63684
• [10272a94b6] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
• [792c410631] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #63564
• [3cfafbc54b] - stream: reject pull() reads on abort (Trivikram Kamat) #63498
• [640a8cede5] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605
• [ece4477872] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
• [2cb84c2daf] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561
• [7d9fdda5fa] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603
• [e2aea3aac7] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
• [ea6300593a] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
• [be1b204fa4] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
• [b3d0d05b05] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
• [046af2609f] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
• [562b831a98] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
• [28e3629dd3] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
• [243aa846de] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
• [6bd07df2bc] - test: add coverage outside SEA (Daijiro Wachi) #63744
• [bd67c9d11b] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
• [e40bfe7081] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
• [444c03fd3b] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
• [771230df78] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
• [0b3cd8e5e6] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
• [0cbc77c60e] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
• [f53dee5fe4] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) #63647
• [3048f8dc1a] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
• [9485caa97e] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
• [34433a4a87] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
• [2e7da29b7c] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
• [205295a31e] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [57d060ed2b] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
• [d2dc6f8506] - tools: bump piscina from 5.1.4 to 5.2.0 in /tools/doc (dependabot[bot]) #64002
• [b0c418f605] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
• [2af8433bef] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
• [8ba5b8574b] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
• [325087be5b] - tools: enforce iterator result property order (Trivikram Kamat) #63526
• [314f417db7] - tools: update the llhttp updater script (Antoine du Hamel) #63819
• [c6e4f5a4fe] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
• [363912acc3] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
• [cfd16e973c] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63760
• [1566872706] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
• [08437a3a5b] - tools: fix zlib updater script (Antoine du Hamel) #63707
• [e883366172] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
• [60e83d9bfd] - util: fix scientific notation formatting (Daijiro Wachi) #63823
• [5f7f60ac36] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
• [af1a11e0dd] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115
• [584e7527c4] - vm: fix property queries for proxy sandboxes (Brian Meek) #63742
• [a926e72eaf] - watch: print name of changed file that triggers restart (Marco) #63781
• [32a2621ca4] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
• [692215d1b1] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556

• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834

• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
• [7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
• [2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
• [e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
• [ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
• [3d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
• [f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
• [e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
• [56e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
• [3bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [1bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [4433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111
• [b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111
• [ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
• [26781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
• [aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
• [407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [61826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
• [16d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
• [3b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
• [141de35399] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
• [b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #63602
• [4ec142314c] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
• [19e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #63463
• [8a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
• [50c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
• [6e56f01c4b] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
• [3ba813b242] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222
• [2390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
• [52a1c18374] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
• [3e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
• [84d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
• [7da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
• [3d79bd8b29] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
• [4f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511
• [388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #63512
• [5258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
• [43e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434
• [f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410
• [c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696
• [398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734
• [fd9e14c405] - doc: update http2's push and trailers events with rawHeaders param (YuSheng Chen) #63259
• [b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329
• [4b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247
• [bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211
• [32ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187
• [4627bcfd82] - doc: run license-builder (github-actions[bot]) #63232
• [28eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #62829
• [2648efd438] - doc: remove unnecessary <!-- eslint- magic comments (Antoine du Hamel) #63200
• [a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181
• [aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #63131
• [7d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121
• [ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #63033
• [27c1c1d842] - doc: remove list of versions in BUILDING.md (Antoine du Hamel) #63113
• [e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152
• [e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
• [6d1f6048d2] - fs: make Date properties on Stats enumerable (LiviaMedeiros) #63328
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
• [39f61fb06c] - http2: emit session close before stream close (Matteo Collina) #63414
• [8a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #62017
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
• [1c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #62979
• [02f35d6dce] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
• [12c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #63465
• [9b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112
• [a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #62823
• [11734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017
• [7cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
• [a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591
• [d56e8d2512] - meta: add vfs subsystem label (René) #62331
• [6201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
• [f095e2bd31] - meta: add additional gitignore entries (James M Snell) #63267
• [1ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402
• [b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63235
• [7d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612
• [a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
• [69df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #62920
• [75d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
• [c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
• [26a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
• [0b534b5770] - quic: fixup linting issue after other changes (James M Snell) #63267
• [4b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #63177
• [2574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #62886
• [30e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673
• [677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255
• [c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206
• [f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #62924
• [92d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #63066
• [8ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #63008
• [85d1639495] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
• [9473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
• [f35c91ee68] - src: improve token return value check (James M Snell) #63483
• [26f677c1c5] - src: expose node::RegisterContext to make a node managed context (Chengzhong Wu) #62322
• [275cf909b6] - src,sqlite: only pass xFilter when user provided a callback (Antoine du Hamel) #63516
• [287e02303f] - src,sqlite: remove dead code (Edy Silva) #63204
• [58fa2ee189] - stream: switch to internal sleep binding (Antoine du Hamel) #63611
• [f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593
• [dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #61197
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834
• [cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #63030
• [61b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161
• [a835363808] - test: update WPT for WebCryptoAPI to 97bbc7247a (Node.js GitHub Bot) #63417
• [a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #62389
• [5a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #63405
• [5e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469
• [ee15380950] - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131 (Node.js GitHub Bot) #63373
• [9e063d9bea] - test: update WPT for url to e4a4672e9e (Node.js GitHub Bot) #63372
• [503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396
• [cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392
• [c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390
• [e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449
• [362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807
• [c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398
• [214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #63395
• [1d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #63386
• [2004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384
• [d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #63244
• [0ff6bf853c] - test: reduce flakiness of different-registry-per-thread (Antoine du Hamel) #63244
• [d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #63361
• [6d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #63100
• [9dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055
• [989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060
• [a072a25ee7] - test: move FFI tests to NATIVE_SUITES (Antoine du Hamel) #63165
• [64efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #63076
• [7dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432
• [d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431
• [288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429
• [904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429
• [df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704
• [ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #63283
• [94e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #63161
• [06d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #63111
• [2e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #63415
• [4c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #63378
• [67d0c490a8] - tools: fix skip of test-internet on forks (Antoine du Hamel) #63492
• [02f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #63075
• [5d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #63374
• [55af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271
• [d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
• [c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612
• [fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999

This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0).

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004